Sign-up

ID

VAR-201412-0611


CVE

CVE-2014-3616


TITLE

nginx In Virtual Host Confusion Attacked vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2014-005829

DESCRIPTION

nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct "virtual host confusion" attacks. Supplementary information : CWE Vulnerability type by CWE-284: Improper Access Control ( Inappropriate access control ) Has been identified. http://cwe.mitre.org/data/definitions/284.htmlBy a third party with certain rights, Virtual Host Confusion An attack may be executed. nginx is prone to a session-fixation vulnerability. An attacker can exploit this issue to hijack an arbitrary session or gain access to the sensitive information. This may aid in further attacks. nginx 0.5.6 through 1.7.4 are vulnerable. nginx is a lightweight web server/reverse proxy server and email (IMAP/POP3) proxy server developed by Russian programmer Igor Sysoev. For the stable distribution (wheezy), this problem has been fixed in version 1.2.1-2.2+wheezy3. For the testing distribution (jessie), this problem has been fixed in version 1.6.2-1. For the unstable distribution (sid), this problem has been fixed in version 1.6.2-1. We recommend that you upgrade your nginx packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJUHRscAAoJEAVMuPMTQ89EGuUP/iedSRE21l/sSyJRUxP5GIoC GjKzrIsbFFDHY9gKH0JUJbVc5ayeEciHLWY7cY119Rlim6/IPpd4T246y4QzPyYd W0tI7eAmmg2zOjCIafubvLHii+FYQ93xSn6Y09CEL9XiHmVxDHS/uDdCBcQKhKaI rXaVc+VAg+I396RcyE6houS1GTPoUmkhJkMKOu4HCutx6foXjT78wLFJEiFLAy9I vVPhZ1+En1PqaJgqry8FEwkreiNF+Lzjb1VLpQzvNzi21uRhz3sPDCy6Y2nkMEhV 4fdYZJKEJGHWC/cdZXCwu5T4lnAZWSB7QYa26yiaUraWO9SrqJw20HgN1YnuGTFf YbeG3qdhMjEYVsdyi0VARtw3yZXfy122/yE0vvaYv0HKFp4Nrzm/5NBysuO+Zcg2 zt422dH9O0bLasJp6lm3tcSzGkfME7Fz63X6/CNupzoFnXcVP+IQpEHYD53+S1mf 3CUPp8sFxauuWuCpMb7hbD8hzYzrPRxB6cRsdAoKxSqTUn+dPOZRFp84tRuW0U5c mBs7DfmfWnnscmTJ/gUbeES+Ac8Tfbrr1Rsz12vAs7onuXxHHH/NSihtsLGYQ17N xzgGSXfgAfnky2J5ZkTOTVE+LvKkoWQX3cq8a+t5JaZjGJZinDkU5CSTOyik80Nr dGeskBuPPhZC1qYrJkyI =XURr -----END PGP SIGNATURE----- . ============================================================================ Ubuntu Security Notice USN-2351-1 September 22, 2014 nginx vulnerability ============================================================================ A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 14.04 LTS Summary: nginx could be made to expose sensitive information over the network. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 14.04 LTS: nginx-core 1.4.6-1ubuntu3.1 nginx-extras 1.4.6-1ubuntu3.1 nginx-full 1.4.6-1ubuntu3.1 nginx-light 1.4.6-1ubuntu3.1 nginx-naxsi 1.4.6-1ubuntu3.1 In general, a standard system update will make all the necessary changes. References: http://www.ubuntu.com/usn/usn-2351-1 CVE-2014-3616 Package Information: https://launchpad.net/ubuntu/+source/nginx/1.4.6-1ubuntu3.1 . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201502-06 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: nginx: Information disclosure Date: February 07, 2015 Bugs: #522994 ID: 201502-06 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== An SSL session fixation vulnerability in nginx may allow remote attackers to obtain sensitive information. Background ========== nginx is a robust, small, and high performance HTTP and reverse proxy server. Workaround ========== There is no known workaround at this time. Resolution ========== All nginx users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/nginx-1.7.6" References ========== [ 1 ] CVE-2014-3616 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3616 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201502-06.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0133 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3616 http://advisories.mageia.org/MGASA-2014-0136.html http://advisories.mageia.org/MGASA-2014-0427.html _______________________________________________________________________ Updated Packages: Mandriva Business Server 2/X86_64: f859044a48eda0b859c931bce3688184 mbs2/x86_64/nginx-1.4.7-1.mbs2.x86_64.rpm 36f49f7a1ca40c8546e82d514023b3f4 mbs2/SRPMS/nginx-1.4.7-1.mbs2.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security

Trust: 2.43

sources: NVD: CVE-2014-3616 // JVNDB: JVNDB-2014-005829 // BID: 70025 // VULHUB: VHN-71556 // VULMON: CVE-2014-3616 // PACKETSTORM: 128332 // PACKETSTORM: 128328 // PACKETSTORM: 130278 // PACKETSTORM: 131099

AFFECTED PRODUCTS

vendor:f5model:nginxscope:ltversion:1.6.2

Trust: 1.0

vendor:f5model:nginxscope:gteversion:1.7.0

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:8.0

Trust: 1.0

vendor:f5model:nginxscope:gteversion:0.5.6

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:7.0

Trust: 1.0

vendor:f5model:nginxscope:ltversion:1.7.5

Trust: 1.0

vendor:igor sysoevmodel:nginxscope:eqversion:0.5.6 to 1.7.4

Trust: 0.8

vendor:nginxmodel:nginxscope:eqversion:1.5.9

Trust: 0.6

vendor:nginxmodel:nginxscope:eqversion:1.5.7

Trust: 0.6

vendor:nginxmodel:nginxscope:eqversion:1.5.8

Trust: 0.6

vendor:nginxmodel:nginxscope:eqversion:1.7.4

Trust: 0.6

vendor:nginxmodel:nginxscope:eqversion:1.7.3

Trust: 0.6

vendor:nginxmodel:nginxscope:eqversion:1.5.6

Trust: 0.6

vendor:nginxmodel:nginxscope:eqversion:1.7.1

Trust: 0.6

vendor:nginxmodel:nginxscope:eqversion:1.7.2

Trust: 0.6

vendor:nginxmodel:nginxscope:eqversion:1.7.0

Trust: 0.6

vendor:nginxmodel:nginxscope:eqversion:1.5.13

Trust: 0.6

vendor:igormodel:sysoev nginxscope:eqversion:1.1.17

Trust: 0.3

vendor:igormodel:sysoev nginxscope:eqversion:1.0.14

Trust: 0.3

vendor:igormodel:sysoev nginxscope:eqversion:1.0.10

Trust: 0.3

vendor:igormodel:sysoev nginxscope:eqversion:1.0.9

Trust: 0.3

vendor:igormodel:sysoev nginxscope:eqversion:1.0.8

Trust: 0.3

vendor:igormodel:sysoev nginxscope:eqversion:0.8.40

Trust: 0.3

vendor:igormodel:sysoev nginxscope:eqversion:0.8.36

Trust: 0.3

vendor:igormodel:sysoev nginxscope:eqversion:0.8.35

Trust: 0.3

vendor:igormodel:sysoev nginxscope:eqversion:0.8.33

Trust: 0.3

vendor:igormodel:sysoev nginxscope:eqversion:0.8.32

Trust: 0.3

vendor:igormodel:sysoev nginxscope:eqversion:0.8.15

Trust: 0.3

vendor:igormodel:sysoev nginxscope:eqversion:0.8.14

Trust: 0.3

vendor:igormodel:sysoev nginxscope:eqversion:0.7.66

Trust: 0.3

vendor:igormodel:sysoev nginxscope:eqversion:0.7.65

Trust: 0.3

vendor:igormodel:sysoev nginxscope:eqversion:0.7.64

Trust: 0.3

vendor:igormodel:sysoev nginxscope:eqversion:0.7.62

Trust: 0.3

vendor:igormodel:sysoev nginxscope:eqversion:0.7.61

Trust: 0.3

vendor:igormodel:sysoev nginxscope:eqversion:0.7

Trust: 0.3

vendor:igormodel:sysoev nginxscope:eqversion:0.6.39

Trust: 0.3

vendor:igormodel:sysoev nginxscope:eqversion:0.6.38

Trust: 0.3

vendor:igormodel:sysoev nginxscope:eqversion:0.6.36

Trust: 0.3

vendor:igormodel:sysoev nginxscope:eqversion:0.6.32

Trust: 0.3

vendor:igormodel:sysoev nginxscope:eqversion:0.6

Trust: 0.3

vendor:igormodel:sysoev nginxscope:eqversion:1.1.19

Trust: 0.3

vendor:igormodel:sysoev nginxscope:eqversion:1.0.15

Trust: 0.3

vendor:gentoomodel:linuxscope: - version: -

Trust: 0.3

vendor:debianmodel:linux sparcscope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux s/390scope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux powerpcscope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux mipsscope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux ia-64scope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux ia-32scope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux armscope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux amd64scope:eqversion:6.0

Trust: 0.3

sources: BID: 70025 // JVNDB: JVNDB-2014-005829 // CNNVD: CNNVD-201410-1268 // NVD: CVE-2014-3616

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2014-3616
value: MEDIUM

Trust: 1.0

NVD: CVE-2014-3616
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201410-1268
value: MEDIUM

Trust: 0.6

VULHUB: VHN-71556
value: MEDIUM

Trust: 0.1

VULMON: CVE-2014-3616
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2014-3616
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-71556
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-71556 // VULMON: CVE-2014-3616 // JVNDB: JVNDB-2014-005829 // CNNVD: CNNVD-201410-1268 // NVD: CVE-2014-3616

PROBLEMTYPE DATA

problemtype:CWE-613

Trust: 1.1

problemtype:CWE-Other

Trust: 0.8

problemtype:CWE-284

Trust: 0.1

sources: VULHUB: VHN-71556 // JVNDB: JVNDB-2014-005829 // NVD: CVE-2014-3616

THREAT TYPE

remote

Trust: 0.7

sources: PACKETSTORM: 130278 // CNNVD: CNNVD-201410-1268

TYPE

code problem

Trust: 0.6

sources: CNNVD: CNNVD-201410-1268

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2014-005829

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-71556

PATCH
title:DSA-3029url:http://www.debian.org/security/2014/dsa-3029
Trust: 0.8
title:CVE-2014-3616url:http://mailman.nginx.org/pipermail/nginx-announce/2014/000147.html
Trust: 0.8
title:nginx-1.7.5url:http://123.124.177.30/web/xxk/bdxqById.tag?id=55253
Trust: 0.6
title:nginx-1.7.5url:http://123.124.177.30/web/xxk/bdxqById.tag?id=55252
Trust: 0.6
title:Ubuntu Security Notice: nginx vulnerabilityurl:https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice&qid=USN-2351-1
Trust: 0.1
title:Debian Security Advisories: DSA-3029-1 nginx -- security updateurl:https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories&qid=3dd41a089230b0ac4671d1b4ec4d3881
Trust: 0.1
title:Debian CVElist Bug Report Logs: nginx:CVE-2014-3616: possible to reuse cached SSL sessions in unrelated contextsurl:https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs&qid=703629f55868e4fc7623e469fe23486b
Trust: 0.1
title:Amazon Linux AMI: ALAS-2014-421url:https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami&qid=ALAS-2014-421
Trust: 0.1
title:Debian CVElist Bug Report Logs: nginx: resolver CVEs: CVE-2016-0742 CVE-2016-0746 CVE-2016-0747url:https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs&qid=10ec4e6c24845a17d787b01f883e17a7
Trust: 0.1
sources:
            
            
            VULMON: CVE-2014-3616 // 
            
            
            
            JVNDB: JVNDB-2014-005829 // 
            
            
            
            CNNVD: CNNVD-201410-1268

EXTERNAL IDS
db:NVDid:CVE-2014-3616
Trust: 3.3
db:JVNDBid:JVNDB-2014-005829
Trust: 0.8
db:CNNVDid:CNNVD-201410-1268
Trust: 0.7
db:BIDid:70025
Trust: 0.5
db:PACKETSTORMid:128332
Trust: 0.2
db:PACKETSTORMid:130278
Trust: 0.2
db:PACKETSTORMid:128328
Trust: 0.2
db:SEEBUGid:SSVID-89321
Trust: 0.1
db:VULHUBid:VHN-71556
Trust: 0.1
db:VULMONid:CVE-2014-3616
Trust: 0.1
db:PACKETSTORMid:131099
Trust: 0.1
sources:
            
            
            VULHUB: VHN-71556 // 
            
            
            
            VULMON: CVE-2014-3616 // 
            
            
            
            BID: 70025 // 
            
            
            
            JVNDB: JVNDB-2014-005829 // 
            
            
            
            PACKETSTORM: 128332 // 
            
            
            
            PACKETSTORM: 128328 // 
            
            
            
            PACKETSTORM: 130278 // 
            
            
            
            PACKETSTORM: 131099 // 
            
            
            
            CNNVD: CNNVD-201410-1268 // 
            
            
            
            NVD: CVE-2014-3616

REFERENCES
url:http://www.debian.org/security/2014/dsa-3029
Trust: 1.8
url:http://mailman.nginx.org/pipermail/nginx-announce/2014/000147.html
Trust: 1.8
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-3616
Trust: 0.9
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-3616
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2014-3616
Trust: 0.4
url:http://nginx.org/
Trust: 0.3
url:http://www.debian.org/security/
Trust: 0.2
url:https://cwe.mitre.org/data/definitions/613.html
Trust: 0.1
url:https://usn.ubuntu.com/2351-1/
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://www.securityfocus.com/bid/70025
Trust: 0.1
url:http://www.debian.org/security/faq
Trust: 0.1
url:http://www.ubuntu.com/usn/usn-2351-1
Trust: 0.1
url:https://launchpad.net/ubuntu/+source/nginx/1.4.6-1ubuntu3.1
Trust: 0.1
url:http://creativecommons.org/licenses/by-sa/2.5
Trust: 0.1
url:http://security.gentoo.org/glsa/glsa-201502-06.xml
Trust: 0.1
url:http://security.gentoo.org/
Trust: 0.1
url:https://bugs.gentoo.org.
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-3616
Trust: 0.1
url:http://advisories.mageia.org/mgasa-2014-0136.html
Trust: 0.1
url:http://www.mandriva.com/en/support/security/
Trust: 0.1
url:http://www.mandriva.com/en/support/security/advisories/
Trust: 0.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0133
Trust: 0.1
url:http://advisories.mageia.org/mgasa-2014-0427.html
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-0133
Trust: 0.1
sources:
            
            
            VULHUB: VHN-71556 // 
            
            
            
            VULMON: CVE-2014-3616 // 
            
            
            
            BID: 70025 // 
            
            
            
            JVNDB: JVNDB-2014-005829 // 
            
            
            
            PACKETSTORM: 128332 // 
            
            
            
            PACKETSTORM: 128328 // 
            
            
            
            PACKETSTORM: 130278 // 
            
            
            
            PACKETSTORM: 131099 // 
            
            
            
            CNNVD: CNNVD-201410-1268 // 
            
            
            
            NVD: CVE-2014-3616

CREDITS
Antoine Delignat-Lavaud and Karthikeyan Bhargavan
Trust: 0.9
sources:
            
            
            BID: 70025 // 
            
            
            
            CNNVD: CNNVD-201410-1268

SOURCES
db:VULHUBid:VHN-71556
db:VULMONid:CVE-2014-3616
db:BIDid:70025
db:JVNDBid:JVNDB-2014-005829
db:PACKETSTORMid:128332
db:PACKETSTORMid:128328
db:PACKETSTORMid:130278
db:PACKETSTORMid:131099
db:CNNVDid:CNNVD-201410-1268
db:NVDid:CVE-2014-3616

LAST UPDATE DATE
2024-08-14T15:39:55.275000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-71556date:2021-11-10T00:00:00
db:VULMONid:CVE-2014-3616date:2020-11-16T00:00:00
db:BIDid:70025date:2015-04-13T21:39:00
db:JVNDBid:JVNDB-2014-005829date:2014-12-10T00:00:00
db:CNNVDid:CNNVD-201410-1268date:2023-05-15T00:00:00
db:NVDid:CVE-2014-3616date:2021-11-10T15:59:33.287

SOURCES RELEASE DATE
db:VULHUBid:VHN-71556date:2014-12-08T00:00:00
db:VULMONid:CVE-2014-3616date:2014-12-08T00:00:00
db:BIDid:70025date:2014-08-06T00:00:00
db:JVNDBid:JVNDB-2014-005829date:2014-12-10T00:00:00
db:PACKETSTORMid:128332date:2014-09-22T20:19:12
db:PACKETSTORMid:128328date:2014-09-22T20:18:28
db:PACKETSTORMid:130278date:2015-02-09T17:00:47
db:PACKETSTORMid:131099date:2015-03-30T21:26:01
db:CNNVDid:CNNVD-201410-1268date:2014-08-06T00:00:00
db:NVDid:CVE-2014-3616date:2014-12-08T11:59:03.390